Switching to TLS 1.3 will probably not really start in earnest until libssl 1.1.1 is installed by default on all major Linux distros. I'm running on Debian 9 a

Switching to TLS 1.3 will probably not really start in earnest until libssl 1.1.1 is installed by default on all major Linux distros. I'm running on Debian 9 and getting nginx to run TLS 1.3 took some work, nothing difficult, but when you see that many (most?) admins don't even bother to change SSH settings from the default, adding extra source lists seems impossible. Also, we're unable to kill off TLS 1.0/1.1 because of all these people running IE... edit: fix libssl version number as mentioned in comment below.